Information processing device, information processing method, and information processing program

Abstract

To provide optimal resilience design information according to an object system.SOLUTION: An information processing device 10 includes a first acquisition unit 20A, a calculation unit 20C, and a selection unit 20D. The first acquisition unit 20A acquires a resilience requirement for an object system 40. The calculation unit 20C calculates a resilience index of the object system 40 to which a countermeasure set is applied, for each countermeasure set in which one or more mutually different countermeasures against resilience are combined. The selection unit 20D selects the countermeasure set satisfying a resilience requirement among the plurality of countermeasure sets as resilience design information, on the basis of the resilience indices calculated for each of the countermeasure sets.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] An embodiment of the present invention relates to an information processing device, an information processing method, and an information processing program. [Background technology]

[0002] Resilience technologies that enable rapid recovery and restoration of normal conditions when disasters or other incidents occur are attracting attention. The concept of cyber resilience technologies, which minimize the impact of cyberattacks and other incidents and enable rapid recovery from the impact, is also gaining popularity. For example, a technology has been disclosed that selects security measures that maximize effectiveness with minimal measures. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 6324646 Summary of the Invention [Problem to be solved by the invention]

[0004] However, in conventional technologies, measures were not selected that took into account the resilience requirements of the target system, and optimal resilience design information for the target system was not provided.

[0005] The problem to be solved by the present invention is to provide an information processing device, an information processing method, and an information processing program that can provide optimal resilience design information according to a target system. [Means for solving the problem]

[0006] According to an embodiment, an information processing device includes a processor that calculates a ratio of an assembled battery capacity of a battery pack in which a plurality of battery cells are connected in series to a cell capacity of a specific battery cell among the plurality of battery cells included in the assembled battery, as an index representing a degree of imbalance in the cell balance of the assembled battery. The calculation unit calculates the resilience index for each countermeasure set based on resilience parameters that represent the degree of improvement for each of multiple resilience items when the countermeasures represented by the countermeasure set are introduced into the target system. [Brief explanation of the drawings]

[0007] [Figure 1] FIG. 1 is a schematic diagram of an information processing device. [Figure 2] Schematic diagram of the data structure of the Cyber ​​Resilience Catalog. [Figure 3] An illustration of resilience requirements. [Figure 4] Schematic diagram of system constraint information. [Figure 5A] Illustration of the calculation of the resilience index. [Figure 5B] Illustration of the calculation of the resilience index. [Figure 6] FIG. 10 is an explanatory diagram of calculation of a first KPI absolute value. [Figure 7] FIG. 10 is an explanatory diagram of calculation of the second KPI absolute value. [Figure 8] Schematic diagram of the data structure of the score conversion table. [Figure 9] 10 is a flowchart showing the flow of information processing. [Figure 10] FIG. 1 is a schematic diagram of an information processing device. [Figure 11] An illustration of resilience requirements. [Figure 12] Schematic diagram of system constraint information. [Figure 13] 10 is a flowchart showing the flow of information processing. [Figure 14] FIG. 1 is a schematic diagram of an information processing device. [Figure 15] 10 is a flowchart showing the flow of information processing. [Figure 16] Hardware configuration diagram. DETAILED DESCRIPTION OF THE INVENTION

[0008] The information processing device, the information processing method, and the information processing program according to the present embodiment will be described in detail below with reference to the accompanying drawings.

[0009] In the following description of each embodiment, parts denoted by the same reference numerals have substantially the same functions, and descriptions of overlapping parts will be omitted where appropriate.

[0010] (First embodiment) FIG. 1 is a schematic diagram of an example of an information processing device 10 according to the present embodiment.

[0011] The information processing device 10 is a computer that selects resilience design information for the target system 40.

[0012] The target system 40 is an information system to which a set of measures for achieving resilience is applied. The target system 40 is configured, for example, from one or more nodes.

[0013] Resilience refers to the mechanisms and capabilities that can be used to minimize the impact of incidents such as various cyber attacks, recover quickly from the impact, and restore a normal state.

[0014] Details of the resilience design information and countermeasure set will be provided later.

[0015] The information processing device 10 includes a UI (user interface) unit 12, a storage unit 14, and a processing unit 20. The UI unit 12, the storage unit 14, and the processing unit 20 are communicatively connected via a bus 16 or the like.

[0016] The UI unit 12 has a display function for displaying various types of information and an input function for receiving operational instructions from the user. In this embodiment, the UI unit 12 has a display unit 12A and an input unit 12B. The display unit 12A is a display for displaying various types of information. The input unit 12B receives operational inputs from the user. The input unit 12B is, for example, a pointing device such as a mouse, a keyboard, etc. The UI unit 12 may be a touch panel in which the display unit 12A and the input unit 12B are integrally configured.

[0017] The storage unit 14 stores various types of information. The storage unit 14 may be a storage device provided outside the information processing device 10. For example, the storage unit 14 may be installed in an external information processing device connected to the information processing device 10 via a network or the like.

[0018] In this embodiment, the storage unit 14 stores in advance a cyber resilience catalog 14A and a score conversion table 14B.

[0019] The Cyber ​​Resilience Catalog 14A is information that shows multiple measures to ensure resilience against cyber attacks. The score conversion table 14B will be described in detail later.

[0020] FIG. 2 is a schematic diagram of an example of the data configuration of the cyber resilience catalog 14A.

[0021] The cyber resilience catalog 14A is information that associates a plurality of measures with resilience parameters and impact parameters corresponding to each of the plurality of measures.

[0022] Countermeasures are security measures to ensure resilience against cyber attacks. Several types of countermeasures are pre-registered in the Cyber ​​Resilience Catalog 14A.

[0023] The resilience parameters are parameters that represent the degree of improvement in resilience when the corresponding measures in the cyber resilience catalog 14A are introduced into a system such as the target system 40. The cyber resilience catalog 14A registers values ​​of resilience parameters that represent the degree of improvement in resilience for each of a plurality of resilience items.

[0024] The resilience items are items that represent resilience when corresponding countermeasures are introduced into a system such as the target system 40. In detail, the resilience items include at least one type of item from among an item related to the success rate of an attack on a system such as the target system 40, an item related to the operating function of the system such as the target system 40, and an item related to the outage period of the target system 40 (for example, recovery time).

[0025] The items related to the attack success rate are, for example, the reduction rate of the attack success rate, the reduction rate of the possibility of outage, etc. The items related to the operating function are, for example, the improvement rate of the function availability rate. The items related to the outage period are, for example, the improvement rate of the recovery time.

[0026] In this embodiment, the resilience items are assumed to be a reduction rate of an attack success rate, an improvement rate of a function availability rate, and an improvement rate of a recovery time, but the resilience items are not limited to these.

[0027] The impact parameters are parameters that represent the degree of impact other than resilience that occurs in a system such as the target system 40 when a countermeasure is introduced to the system. The cyber resilience catalog 14A stores the values ​​of impact parameters that represent the degree of impact of each of multiple impact items when the corresponding countermeasure is introduced to the system. Note that the impact items are assumed to be the same as the constraint items described below.

[0028] Returning to Figure 1, we continue the explanation.

[0029] Next, we will explain the processing unit 20. The processing unit 20 executes information processing in the information processing device 10. The processing unit 20 has a first acquisition unit 20A, a second acquisition unit 20B, a calculation unit 20C, a selection unit 20D, and an output control unit 20E.

[0030] The first acquisition unit 20A, the second acquisition unit 20B, the calculation unit 20C, the selection unit 20D, and the output control unit 20E are realized, for example, by one or more processors. For example, each of the above units may be realized by having a processor such as a CPU (Central Processing Unit) execute a program, i.e., by software. Each of the above units may be realized by a processor such as a dedicated IC, i.e., by hardware. Each of the above units may be realized by a combination of software and hardware. When multiple processors are used, each processor may realize one of the units, or may realize two or more of the units. Furthermore, at least one of the above units may be provided in an external information processing device connected to the information processing device 10 via a network.

[0031] The first acquisition unit 20A acquires the resilience requirements for the target system 40.

[0032] The resilience requirement represents a requirement for resilience required of the target system 40. In other words, the resilience requirement represents a level of resilience required of the target system 40. For example, the resilience requirement represents a level of resilience required of the target system 40 by a user.

[0033] The first acquisition unit 20A acquires, for example, resilience requirements for the target system 40 input by a user operating the UI unit 12, from the UI unit 12. The first acquisition unit 20A may also acquire resilience requirements for the target system 40 from an external information processing device connected to the information processing device 10 via a network or the like. The first acquisition unit 20A may also acquire resilience requirements for the target system 40 by reading resilience requirements for the target system 40 that have been stored in advance in the storage unit 14 from the storage unit 14.

[0034] FIG. 3 is a diagram illustrating an example of resilience requirements.

[0035] The resilience requirements are expressed, for example, by target conditions to be met by KPIs (Key Performance Indicators).

[0036] KPI is a quantitative index for measuring the degree of achievement of a goal. In this embodiment, it is assumed that a smaller KPI value means a higher evaluation value.

[0037] The target condition to be satisfied by the KPI is expressed, for example, by a conditional expression using the KPI. Figure 3 shows an example of a conditional expression expressing a resilience requirement, "KPI_rel<0.3."

[0038] KPI_rel represents the KPI relative value. The KPI relative value represents the ratio of the KPI absolute value after the introduction of resilience measures to the KPI absolute value before the introduction of resilience measures. The KPI absolute value represents each KPI before and after the introduction of resilience measures.

[0039] That is, in this embodiment, a form will be described as an example in which the first acquiring unit 20A acquires a conditional expression of a KPI relative value as a resilience requirement.

[0040] The first acquiring unit 20A may acquire, as a resilience requirement, a conditional expression for the KPI absolute value, which is the KPI after the introduction of a resilience measure.

[0041] Also, the target conditions to be satisfied by the KPI may be expressed in words representing the target level. For example, the target conditions to be satisfied by the KPI may be words representing the target levels of the KPI such as "large", "medium", "small", etc. In this case, the correspondence between the range of values representing the KPI and the words representing the levels such as "large", "medium", "small", etc. may be defined in advance, and the word representing the level corresponding to the value representing the KPI input by the UI unit 12 may be used as the resilience requirement. For example, conversion rules such as representing the level "large" when KPI ≤ 0.1, representing the level "medium" when 0.1 < KPI ≤ 0.3, and representing the level "small" when 0.3 < KPI may be defined in advance. Then, the first acquisition unit 20A may acquire, as the resilience requirement, the word representing the level corresponding to the value acquired from the UI unit 12 (for example, the level "medium", etc.).

[0042] In the present embodiment, an example of a form in which the first acquisition unit 20A acquires a conditional expression (see FIG. 3) representing the resilience requirement as the resilience requirement will be described.

[0043] Returning to FIG. 1, the description will be continued.

[0044] The second acquisition unit 20B acquires system constraint information regarding the target system 40.

[0045] The system constraint information is information representing the constraint requirement level required for each constraint item regarding the target system 40. For example, the system constraint information represents the constraint requirement level that the user requests for the target system 40.

[0046] The constraint item is an item representing a constraint other than resilience regarding the target system 40. In the present embodiment, an example of a form in which the constraint item and the influence item match will be described. As described above, in the present embodiment, an example of a form in which the influence items are the introduction cost, the operation cost, and the system load will be described. For this reason, in the present embodiment, an example of a form in which the constraint items are the introduction cost, the operation cost, and the system load will be described.

[0047] The second acquisition unit 20B acquires, for example, system constraint information for the target system 40 input by a user operating the UI unit 12, from the UI unit 12. The second acquisition unit 20B may also acquire system constraint information for the target system 40 from an external information processing device connected to the information processing device 10 via a network or the like. The second acquisition unit 20B may also acquire system constraint information for the target system 40 by reading, from the storage unit 14, system constraint information for the target system 40 that has been stored in advance in the storage unit 14.

[0048] FIG. 4 is a schematic diagram of an example of system constraint information.

[0049] The second acquisition unit 20B acquires information indicating the constraint requirement level required for each of these multiple constraint items, such as "high requirement," "medium requirement," or "low requirement." Fig. 4 shows a scene in which the second acquisition unit 20B acquires system constraint information indicating "high requirement" for installation cost, "medium requirement" for operation cost, and "high requirement" for system load.

[0050] Returning to Figure 1, we continue the explanation.

[0051] The calculation unit 20C calculates the resilience index of the target system 40 to which the countermeasure set is applied, for each of a plurality of countermeasure sets each of which combines one or a plurality of mutually different countermeasures for resilience.

[0052] First, the calculation unit 20C uses a plurality of measures registered in the cyber resilience catalog 14A to generate a plurality of sets of measures that differ in at least one of the number and type of measures included.

[0053] Specifically, the calculation unit 20C selects one or more measures from the plurality of measures registered in the cyber resilience catalog 14A and generates a plurality of measure sets. The calculation unit 20C may generate a plurality of measure sets for all combinations that satisfy the condition that at least one of the number and type of included measures is different. Furthermore, the calculation unit 20C may generate a predetermined number of measure sets from among the plurality of measure sets for all combinations that satisfy this condition.

[0054] Then, the calculation unit 20C calculates, for each of the generated countermeasure sets, the resilience index of the target system 40 to which the countermeasure set has been applied.

[0055] The resilience index is an evaluation value of resilience when the countermeasure set is applied to the target system 40. The resilience index and the above-mentioned resilience requirements are expressed by the same index. For this reason, in this embodiment, an example will be described in which the resilience index is expressed by a KPI. In detail, in this embodiment, an example will be described in which a KPI relative value indicating the ratio of the KPI after the introduction of resilience measures to the KPI before the introduction of resilience measures is used as the resilience index. Note that a KPI absolute value, which is the KPI after the introduction of resilience measures, may also be used as the resilience index.

[0056] The calculation unit 20C calculates a resilience index for each countermeasure set based on resilience parameters that indicate the degree of improvement of each resilience item when the countermeasures represented by the countermeasure set are introduced into the target system 40.

[0057] The method of calculating the resilience index by the calculation unit 20C will be described in detail below.

[0058] 5A and 5B are explanatory diagrams of an example of calculation of a resilience index for each countermeasure set by the calculation unit 20 C. The calculation unit 20 C calculates a resilience index for each countermeasure set by performing the following calculation for each of the created countermeasure sets.

[0059] In detail, the calculation unit 20C calculates a first KPI absolute value and a second KPI absolute value. The first KPI absolute value and the second KPI absolute value are examples of KPI absolute values. The first KPI absolute value is the KPI absolute value before the measures constituting the measure set are introduced into the target system 40. The second KPI absolute value is the KPI absolute value after the measures constituting the measure set are introduced into the target system 40.

[0060] FIG. 5A is a diagram illustrating an example of calculation of the first KPI absolute value.

[0061] In Figure 5A, the vertical axis represents the function availability rate, and the horizontal axis represents time. The function availability rate is expressed as a value between 0 and 1. A function availability rate of "1" represents a state in which all functions included in the target system 40 are operating. A function availability rate of "0" represents a state in which all functions included in the target system 40 are not operating, i.e., all functions are stopped. Therefore, if 30% of the functions in the target system 40 are operating, the function availability rate will be "0.3".

[0062] In FIG. 5A, a line 30 represents the transition of the functional availability rate of the target system 40 before the introduction of the countermeasures included in the countermeasure set, when an incident occurs at time x.

[0063] In Figure 5A, XB represents the recovery time. Specifically, XB represents the time (period) required for the function availability rate to return to "1.0" when an incident occurs at time x. YB represents the function outage rate calculated from the function availability rate, and is expressed by the following formula (1).

[0064] YB = 1 - Functional availability Equation (1)

[0065] The area represented by XB × YB is called the resilience area 30A. The resilience area 30A represents the integral value of the functional availability rate when it takes time XB from the occurrence of an incident until the functional availability rate returns to "1.0". The smaller this resilience area 30A is, the smaller the impact of the incident on the target system 40.

[0066] Then, the calculation unit 20C calculates the first KPI absolute value of the measures included in the measure set using the following formula (2).

[0067] First KPI absolute value KPI_abs = XB × YB × ZB Equation (2)

[0068] ZB represents the attack occurrence rate against the target system 40 before the countermeasures constituting the countermeasure set are introduced.

[0069] For example, assume that XB is "10" and the functional availability rate is "0.3." In this case, the calculation unit 20C calculates "0.7" as the resilience area 30A by calculating XB × YB = 10 × (1 - 0.3). Also assume that ZA is "1." In this case, the calculation unit 20C calculates "0.7" as the first KPI absolute value by calculating XB × YB × ZB = 10 × (1 - 0.3) × 1.

[0070] FIG. 5B is a diagram illustrating an example of calculation of the second KPI absolute value.

[0071] In Fig. 5B, the vertical axis represents the functional availability rate, and the horizontal axis represents time. In Fig. 5B, line 32 represents the transition of the functional availability rate of target system 40 after the implementation of the countermeasures constituting the countermeasure set, when an incident occurs at time x.

[0072] In FIG. 5B, XA represents the recovery time. More specifically, XA represents the time (period) required for the functional availability rate to return to "1.0" after an incident occurs at time x. YA represents the functional outage rate calculated from the functional availability rate. ZA represents the attack occurrence rate against the target system 40 after the implementation of the countermeasures included in the countermeasure set. More specifically, XA, YA, and ZA are expressed by the following formulas (3A) to (3C).

[0073] XA = XB × (1 - improvement rate of total recovery time) Equation (3A) YA = YB × (1 - improvement rate of total functional availability) Equation (3B) ZA = ZB × (1 - reduction rate of total attack success rate) Equation (3C)

[0074] The improvement rate of the total recovery time represents the improvement rate of the recovery time after the measures constituting the measure set are introduced into the target system 40 .

[0075] The calculation unit 20C reads the value of the resilience parameter corresponding to the resilience item "improvement rate of recovery time" shown in the cyber resilience catalog 14A for each of one or more measures constituting the countermeasure set. Then, the calculation unit 20C identifies the resilience parameter value that represents the highest improvement rate among the resilience parameter values ​​for the resilience item "improvement rate of recovery time" read for each of one or more measures constituting the countermeasure set. In other words, the calculation unit 20C identifies the resilience parameter value with the largest value among the resilience parameter values ​​for the resilience item "improvement rate of recovery time" read for each of one or more measures constituting the countermeasure set.

[0076] Then, the calculation unit 20C specifies the value of the specified resilience parameter as the value of the resilience item “improvement rate of recovery time” in the countermeasure set. Then, the calculation unit 20C may calculate the recovery time XA using the above formula (3A).

[0077] For example, assume that the only measure included in the measure set to be processed is "Firewall." The resilience item "Improvement rate of recovery time" corresponding to "Firewall" shown in the cyber resilience catalog 14A (see FIG. 2A) is "0%." Also assume that XB = 1. In this case, the calculation unit 20C calculates "1," which is the calculation result of XA = 1 × 1, as the recovery time XA using the above formula (3A).

[0078] Also, for example, assume that the measures included in the countermeasure set to be processed are "Firewall" and "Degeneration." The "Improvement Rate of Recovery Time" resilience item corresponding to "Firewall" and "Degeneration" shown in the cyber resilience catalog 14A (see FIG. 2A) is "0%" for both. Also assume that XB = 1. In this case, the calculation unit 20C calculates "1," which is the calculation result of XA = 1 × 1, as the recovery time XA using the above formula (3A).

[0079] The improvement rate of the total functional availability rate represents the improvement rate of the functional availability rate after the measures constituting the measure set are introduced into the target system 40 .

[0080] The calculation unit 20C reads the value of the resilience parameter for the resilience item "improvement rate of functional availability" shown in the cyber resilience catalog 14A for each of one or more measures constituting the measure set. Then, the calculation unit 20C identifies the resilience parameter value that represents the highest improvement rate among the resilience parameter values ​​for the resilience item "improvement rate of functional availability" read for each of one or more measures constituting the measure set. In other words, the calculation unit 20C identifies the resilience parameter value with the largest value among the resilience parameter values ​​for the resilience item "improvement rate of functional availability" read for each of one or more measures constituting the measure set.

[0081] Then, the calculation unit 20C specifies the value of the specified resilience parameter as the value of the resilience item “improvement rate of functional availability” in the countermeasure set. Then, the calculation unit 20C may calculate the functional outage rate YA using the above formula (3B).

[0082] For example, assume that the only measure that constitutes the countermeasure set to be processed is "Firewall." The resilience item "Improvement rate of functional availability" corresponding to "Firewall" shown in the cyber resilience catalog 14A (see FIG. 2A) is "0%." Also assume that YB=1. In this case, the calculation unit 20C calculates "1," which is the calculation result of YA=1×1, as the functional outage rate YA using the above formula (3B).

[0083] Also, for example, assume that the measures constituting the countermeasure set to be processed are "Firewall" and "Degeneration." The "Improvement Rate of Functional Availability" resilience items corresponding to "Firewall" and "Degeneration" shown in the cyber resilience catalog 14A (see FIG. 2A) are "0%" and "50%, respectively. In this case, the calculation unit 20C identifies the higher improvement rate, i.e., the larger value of "50%, " as the "Improvement Rate of Total Functional Availability" for the countermeasure set. Also assume that XB = 1. In this case, the calculation unit 20C calculates "0.5," which is the calculation result of XA = 1 × (1 - 0.5), using the above formula (3A), as the functional outage rate YA.

[0084] The reduction rate of the total attack success rate represents the improvement rate of the attack success rate after the countermeasures constituting the countermeasure set are introduced into the target system 40 .

[0085] The calculation unit 20C reads the value of the resilience parameter for the resilience item "reduction rate of attack success rate" shown in the cyber resilience catalog 14A for each of one or more measures constituting the countermeasure set. Then, the calculation unit 20C identifies the resilience parameter value that represents the highest reduction rate among the resilience parameter values ​​for the resilience item "reduction rate of attack success rate" read for each of one or more measures constituting the countermeasure set. In other words, the calculation unit 20C identifies the resilience parameter value with the largest value among the resilience parameter values ​​for the resilience item "reduction rate of attack success rate" read for each of one or more measures constituting the countermeasure set.

[0086] Then, the calculation unit 20C specifies the value of the specified resilience parameter as the value of the resilience item “reduction rate of attack success rate” in the countermeasure set. Then, the calculation unit 20C may calculate the attack occurrence rate ZA using the above formula (3C).

[0087] For example, assume that the only measure that constitutes the countermeasure set to be processed is "Firewall." The resilience item "Reduction rate of attack success rate" corresponding to "Firewall" shown in the cyber resilience catalog 14A (see FIG. 2A) is "50%." Also assume that ZB=1. In this case, the calculation unit 20C calculates "0.5," which is the calculation result of ZA=1×(1-0.5), as the attack occurrence rate ZA using the above formula (3C).

[0088] Also, for example, assume that the countermeasures constituting the countermeasure set to be processed are "Firewall" and "Antivirus." The resilience items "Attack Success Rate Reduction Rate" corresponding to "Firewall" and "Antivirus" shown in the cyber resilience catalog 14A (see FIG. 2A) are "50%" and "30%, respectively. In this case, the calculation unit 20C identifies the higher reduction rate, i.e., the larger value of "50%, " as the "Total Attack Success Rate Reduction Rate" for the countermeasure set. Also assume that ZB = 1. In this case, the calculation unit 20C calculates "0.5", which is the calculation result of ZA = 1 × (1 - 0.5), as the attack occurrence rate ZA using the above formula (3C).

[0089] As described above, in this embodiment, when a countermeasure set includes multiple countermeasures, the calculation unit 20C identifies the resilience parameter value that represents the highest improvement rate or the highest reduction rate from among the multiple resilience parameter values ​​read for each of the multiple countermeasures. That is, when a countermeasure set includes multiple countermeasures, the calculation unit 20C identifies the resilience parameter value with the largest value from among the multiple resilience parameter values ​​read for each of the multiple countermeasures.

[0090] However, when the countermeasure set includes multiple countermeasures, the calculation unit 20C may identify a parameter value that is adjusted to an even larger value than the largest value among the multiple resilience parameter values ​​read for each of the multiple countermeasures, depending on the type of resilience item.

[0091] Specifically, for example, let us assume that the measures constituting the target measure set are "Firewall" and "Antivirus". Also, let us assume a situation where we want to calculate the attack success rate ZA for the resilience item "Reduction rate of attack success rate".

[0092] In this case, the resilience items "Attack Success Rate Reduction Rate" corresponding to "Firewall" and "Antivirus" shown in the cyber resilience catalog 14A (see FIG. 2A) are "50%" and "30%, respectively. Here, the more measures implemented, the more the attack success rate reduction rate may improve compared to when a single measure is implemented. Therefore, the calculation unit 20C may multiply the larger value of "50%" by a correction value greater than 1 that corresponds to the combination of measures, and determine the result as the "total attack success rate reduction rate" of the measure set. This correction value may be set in advance for each resilience item included in each of multiple measure sets that include different combinations of measures.

[0093] Then, the calculation unit 20C calculates the second KPI absolute value using the following formula (4).

[0094] Second KPI absolute value KPI_abs = XA × YA × ZA (4)

[0095] The area represented by XA × YA is called the resilience area 32A. The resilience area 32A represents the integral value of the functional availability rate when it takes time XA from the occurrence of an incident until the functional availability rate returns to "1.0". The smaller this resilience area 32A is, the smaller the impact of the incident on the target system 40.

[0096] Then, the calculation unit 20C calculates, as the resilience index, a KPI relative value that indicates the ratio of the second KPI absolute value to the first KPI absolute value (second KPI absolute value / first KPI absolute value). That is, the calculation unit 20C calculates, as the resilience index, a value that is found using the integral (resilience area 32A, resilience area 32A) obtained by integrating the function outage rate (YB, YA) obtained from the function availability rate by the recovery time (XB, XA), and the attack success rate (ZB, ZA).

[0097] Specifically, the calculation unit 20C calculates the KPI relative value representing the resilience index using the following formula (5).

[0098] KPI relative value KPI_rel = (XA × YA × ZA) / (XB × YB × ZB) Formula (5)

[0099] FIG. 6 is an explanatory diagram of an example of the calculation result by the calculation unit 20C.

[0100] The calculation unit 20C calculates the resilience index for each of the multiple countermeasure sets using the resilience parameters represented in the cyber resilience catalog 14A, thereby making it possible to calculate, for example, the resilience index shown in Figure 6 for each countermeasure set.

[0101] Fig. 6 shows the case where the KPI relative value KPI_rel for each countermeasure set calculated by the calculation unit 20C according to the above-mentioned calculation method, where XB = YB = ZB = 1, is found as the resilience index. In addition, the resilience parameter column in Fig. 6 shows, for each resilience item, the largest value in the cyber resilience catalog 14A shown in Fig. 2 among the resilience parameters corresponding to the countermeasures that make up the corresponding countermeasure set, as the value to be used in the above calculation.

[0102] In the example shown in FIG. 6, the KPI relative value (KPI_rel), which is a resilience index, of the countermeasure set consisting only of "multiplexing" is the smallest, and the KPI relative value (KPI_rel), which is a resilience index, of the countermeasure set consisting only of "Firewall" and "Degeneration" is the next smallest. As described above, in this embodiment, the smaller the KPI value, the higher the evaluation value. Therefore, in the example shown in FIG. 6, the countermeasure set consisting only of "multiplexing" has the highest evaluation value of the resilience index, and the countermeasure set consisting only of "Firewall" and "Degeneration" has the next highest evaluation value of the resilience index.

[0103] 5B shows an example in which the resilience area 32A is calculated as the area of ​​a rectangular region represented by XA×YA. However, the resilience area 32A is not limited to the area of ​​a rectangular region.

[0104] 7 is a diagram illustrating an example of calculation of the second KPI absolute value. As shown in FIG. 7, the functional availability rate may be recovered or lost in stages.

[0105] In Fig. 7, the vertical axis represents the functional availability rate, and the horizontal axis represents time. In Fig. 7, line 34 represents the transition of the functional availability rate of target system 40 after the implementation of the countermeasures that make up the countermeasure set, when an incident occurs at time x.

[0106] In Figure 7, XA represents the recovery time. In detail, XA represents the time (period) required from the occurrence of an incident at time x until the functional availability rate returns to "1.0". YA(t) represents the functional availability rate. ZA represents the attack occurrence rate against the target system 40 after the measures included in the countermeasure set are introduced. In this case, YA(t) is expressed by the following formula (6), and the second KPI absolute value after the measures constituting the countermeasure set are introduced into the target system 40 is expressed by the following formula (7). In addition, the KPI relative value representing the resilience index is expressed by the following formula (8).

[0107] ∫YA(t)...Equation (6)

[0108] KPI_abs=∫YA(t)×ZA...Equation (7) KPI_rel=∫YA(t)×ZA×ZA / (XB×YB×ZB) Formula (8)

[0109] In equations (6) to (8), t represents time, t represents a value in the range of x to x+XA, and x represents the time when the incident occurs.

[0110] The calculation method of the resilience index by the calculation unit 20C is not limited to the above method. For example, an index of quality of service (QoS) may be used instead of the functional availability rate as the vertical axis in Figures 5A, 5B, and 7. Furthermore, the calculation unit 20C may use the amount of damage at the time of incident occurrence instead of the resilience area calculated from the functional availability rate and time.

[0111] In this embodiment, the calculation unit 20C further calculates a constraint satisfaction score.

[0112] The constraint satisfaction score is a score that indicates the degree to which the countermeasure set satisfies the constraints represented by the system constraint information acquired by the second acquisition unit 20B.

[0113] First, the calculation unit 20C calculates, for each countermeasure set, a score representing the degree of fulfillment of the constraint requirements for each constraint item according to the impact parameters and the constraint requirement level for each constraint item represented by the system constraint information acquired by the second acquisition unit 20B.

[0114] First, calculation unit 20C calculates the score using score conversion table 14B.

[0115] FIG. 8 is a schematic diagram showing an example of the data configuration of the score conversion table 14B.

[0116] The score conversion table 14B is information representing scores corresponding to the degree of influence represented by the influence parameter and the constraint requirement level. Scores that represent larger values ​​as the degree of influence increases and as the constraint requirement level increases are pre-registered in the score conversion table 14B.

[0117] The calculation unit 20C identifies, for each constraint item represented by the system constraint information acquired by the second acquisition unit 20B, a score corresponding to the constraint requirement level of the constraint item and the degree of impact of each impact item indicated in the impact parameters shown in the cyber resilience catalog 14A, from the score conversion table 14B. The calculation unit 20C identifies the identified score as a score representing the degree of fulfillment of the constraint requirement for each constraint item.

[0118] For example, it is assumed that the countermeasure set includes only the "Firewall" countermeasure, and that the second acquisition unit 20B has acquired the system constraint information shown in FIG.

[0119] In this case, the calculation unit 20C identifies, from the score conversion table 14B, a cost of "0" corresponding to the constraint requirement level of "high requirement" for the constraint item "implementation cost" included in the system constraint information acquired by the second acquisition unit 20B and the impact degree of "low" for the impact item "implementation cost," which is the same as the constraint item corresponding to the measure "Firewall" in the cyber resilience catalog 14A. Then, the calculation unit 20C calculates this identified cost of "0" as the score of the constraint item "implementation cost" corresponding to the measure set.

[0120] In addition, when the countermeasure set is composed of multiple countermeasures, the calculation unit 20C may calculate the score using the greatest impact degree among the impact degrees of the impact items to be calculated that correspond to each of the multiple countermeasures in the cyber resilience catalog 14A.

[0121] For example, it is assumed that the countermeasure set is made up of "Firewall" and "Degeneration." It is also assumed that the second acquisition unit 20B has acquired the system constraint information shown in FIG.

[0122] In this case, the calculation unit 20C identifies the impact level as "medium" among the impact level of "small" for the impact item "implementation cost" corresponding to the measure "Firewall" in the cyber resilience catalog 14A and the impact level of "medium" for the impact item "implementation cost" corresponding to the measure "degeneration."The calculation unit 20C then identifies, from the score conversion table 14B, a cost of "0.6" corresponding to the constraint requirement level of "high requirement" and the impact level of "medium" for the constraint item "implementation cost," which is the same as the impact item included in the system constraint information acquired by the second acquisition unit 20B.The calculation unit 20C then calculates this identified cost of "0.6" as the score of the constraint item "implementation cost" corresponding to the measure set.

[0123] The calculation unit 20C calculates the scores representing the degree of fulfillment of the constraint requirements for each constraint item in the same manner for the other constraint items "operation cost" and "system load".

[0124] Then, the calculation unit 20C uses the score calculated for each constraint item to calculate a constraint satisfaction score that indicates the degree of satisfaction of the constraints represented by the system constraint information for each countermeasure set.

[0125] For example, the calculation unit 20C calculates the total value of the scores calculated for each of the plurality of constraint items for each of the plurality of countermeasure sets as the constraint satisfaction score of the corresponding countermeasure set.

[0126] Specifically, assume that the score of the constraint item "implementation cost" of a certain measure set is "0.6," the score of the constraint item "operation cost" is "0.3," and the score of the constraint item "system load" is "0." In this case, the calculation unit 20C calculates the total value of these scores, "0.9," as the constraint satisfaction score of the measure set.

[0127] The scores and constraint satisfaction scores calculated by the calculation unit 20C are further shown in Fig. 6. Fig. 6 also shows the scores of the influential items used to calculate the constraint satisfaction scores.

[0128] 6, by performing the above calculations, the calculation unit 20C calculates a score for each influencing item (i.e., constraint item) for each of the multiple countermeasure sets, and calculates a constraint satisfaction score represented by the sum of these scores. In this embodiment, the smaller the constraint satisfaction score, the more the constraints are satisfied.

[0129] Returning to Figure 1, we continue the explanation.

[0130] Based on the resilience index (KPI relative value) calculated for each of the multiple countermeasure sets, the selection unit 20D selects from the multiple countermeasure sets a countermeasure set that satisfies the resilience requirements acquired by the first acquisition unit 20A as the optimal resilience design information for the target system 40.

[0131] This will be explained using Fig. 6. For example, assume that the calculation unit 20C calculates the resilience index (KPI relative value) and constraint satisfaction score shown in Fig. 6 for each countermeasure set for a certain target system 40.

[0132] The selection unit 20D identifies a set of measures from among the generated sets of measures, the set of measures having a KPI relative value, which is a resilience index, that satisfies the resilience requirement acquired by the first acquisition unit 20A.

[0133] For example, assume that the resilience requirement acquired by the first acquisition unit 20A indicates a KPI relative value of less than 0.3, as shown in Fig. 3. In this case, the selection unit 20D identifies, from among the countermeasure sets shown in Fig. 6, a countermeasure set consisting of only "multiplexing," and a countermeasure set consisting of "Firewall" and "degeneration," each of which has a KPI relative value, which is a resilience index, of less than 0.3, as countermeasure sets that satisfy the resilience requirement.

[0134] Then, the selection unit 20D selects the identified set of measures that satisfy the resilience requirements as the optimal resilience design information for the target system 40.

[0135] Furthermore, the selection unit 20D may further select, as resilience design information, a set of measures whose resilience indexes satisfy the resilience requirements acquired by the first acquisition unit 20A and whose constraint satisfaction scores satisfy predetermined conditions.

[0136] The predetermined condition may be determined in advance. For example, the predetermined condition may be a set of N measures in descending order of the degree of constraint satisfaction represented by the constraint satisfaction score. N is an integer equal to or greater than 1. N may be changeable as appropriate in response to an operation instruction by a user on the UI unit 12, etc.

[0137] As described above, in this embodiment, the smaller the constraint satisfaction score, the more the constraints are satisfied. Therefore, in this embodiment, the selection unit 20D selects N countermeasure sets in ascending order of constraint satisfaction score, for example.

[0138] Specifically, for example, assume that the selection unit 20D has identified a countermeasure set consisting only of the countermeasure "multiplexing" and a countermeasure set consisting of the countermeasure "firewall" and the countermeasure "degeneration", both of which have a KPI relative value of less than 0.3, from the countermeasure sets shown in Fig. 6. The countermeasure set consisting only of the countermeasure "multiplexing" has a constraint satisfaction score of "1.3", and the countermeasure set consisting of the countermeasure "firewall" and the countermeasure "degeneration" has a constraint satisfaction score of "0.9".

[0139] In this case, the selection unit 20D selects N countermeasure sets in ascending order of constraint satisfaction score values. If N is "1", the selection unit 20D selects a countermeasure set consisting of the countermeasure "Firewall" and the countermeasure "Degeneration" as the optimal resilience design information for the target system 40. If N is "2", the selection unit 20D selects a countermeasure set consisting of the countermeasure "Firewall" and the countermeasure "Degeneration", and a countermeasure set consisting only of the countermeasure "Multiplexing", as the optimal resilience design information for the target system 40. At this time, the selection unit 20D may assign an overall ranking to the selected countermeasure sets in descending order of constraint satisfaction represented by the constraint satisfaction score.

[0140] Returning to Figure 1, we continue the explanation.

[0141] The output control unit 20E outputs the resilience information selected by the selection unit 20D. The output control unit 20E may also output the resilience information selected by the selection unit 20D and at least one of the resilience requirements acquired by the first acquisition unit 20A and the system constraint conditions acquired by the second acquisition unit 20B. The output control unit 20E may further sort the resilience information selected by the selection unit 20D in descending order of the degree of constraint satisfaction represented by the constraint satisfaction score, and output the resilience information. The output control unit 20E may also output the resilience design information selected by the selection unit 20D in association with the above-mentioned overall ranking assigned to the resilience setting information.

[0142] For example, the output control unit 20E outputs the resilience information selected by the selection unit 20D to the UI unit 12. Furthermore, as described above, the output control unit 20E may output the selected resilience information and at least one of the resilience requirements, the system constraint conditions, and the overall ranking to the UI unit 12. By visually checking the UI unit 12, the user can confirm the resilience design information, which is the optimal set of measures for the target system 40.

[0143] Furthermore, for example, the output control unit 20E may output the resilience information selected by the selection unit 20D to an external information processing device via a network or the like. Furthermore, the output control unit 20E may store the resilience information selected by the selection unit 20D in the storage unit 14. In this case, the output control unit 20E may output the selected resilience information and at least one of the resilience requirements, the system constraint conditions, and the overall ranking to the external information processing device or store them in the storage unit 14.

[0144] Next, an example of the flow of information processing executed by the information processing device 10 of this embodiment will be described.

[0145] FIG. 9 is a flowchart showing an example of the flow of information processing executed by the information processing device 10 of this embodiment.

[0146] The first acquisition unit 20A acquires resilience requirements for the target system 40 (step S100). For example, a user inputs a desired resilience requirement by operating the UI unit 12. The first acquisition unit 20A acquires the resilience requirement input by the user from the UI unit 12.

[0147] The second acquisition unit 20B acquires system constraint information for the target system 40 (step S102). For example, the user inputs desired system constraint information by operating the UI unit 12. The second acquisition unit 20B acquires the system constraint information input by the user from the UI unit 12.

[0148] The calculation unit 20C uses a plurality of measures registered in the cyber resilience catalog 14A to generate a plurality of sets of measures that differ in at least one of the number and type of measures included (step S104).

[0149] Then, the calculation unit 20C and the selection unit 20D repeat steps S106 to S116 for each of the multiple countermeasure sets generated in step S104.

[0150] In detail, the calculation unit 20C calculates resilience parameters that represent the degree of improvement of each resilience item when the measures constituting the countermeasure set to be processed are introduced to the target system 40 (step S106). The calculation unit 20C reads the value of the resilience parameter for each resilience item listed in the cyber resilience catalog 14A for each of one or more measures constituting the countermeasure set. Then, the calculation unit 20C calculates, as the resilience parameter for each resilience item, the value of the resilience parameter that represents the highest improvement rate within each resilience item from the resilience parameter values ​​read for each resilience item.

[0151] Then, the calculation unit 20C calculates a resilience index using the value of each resilience parameter of the resilience items calculated in step S106 (step S108). As described above, for example, the calculation unit 20C calculates the KPI relative value as the resilience index.

[0152] Next, the calculation unit 20C calculates a score representing the degree of fulfillment of the constraint requirements for each constraint item for the countermeasure set being processed, based on the impact parameters and the constraint requirement level for each constraint item represented by the system constraint information acquired in step S102 (step S110).

[0153] Then, the calculation unit 20C uses the score calculated for each constraint item in step S110 to calculate a constraint satisfaction score representing the degree of satisfaction of the constraints represented by the system constraint information for the action set to be processed (step S112).

[0154] Next, the selection unit 20D determines whether the resilience index calculated in step S108 satisfies the resilience requirements acquired in step S100 (step S114). If it is determined that the resilience requirements are not satisfied (step S114: No), the processing for the countermeasure set is terminated. If it is determined that the resilience requirements are satisfied (step S114: Yes), the processing proceeds to step S116.

[0155] In step S116, the selection unit 20D stores the countermeasure set to be processed, for which a positive determination was made in step S114, in the storage unit 14 as a countermeasure set for use in ranking calculation (step S116).

[0156] The calculation unit 20C and the selection unit 20D execute the processes of steps S106 to S116 for each of the multiple countermeasure sets generated in step S104, and thereby a countermeasure set of a resilience index that satisfies the resilience requirements is stored as a countermeasure set for ranking calculation in the storage unit 14. At this time, the selection unit 20D may store in the storage unit 14 at least one of the resilience requirements used in calculating the countermeasure set, the system constraint information, the resilience index, the constraint satisfaction score, and the overall ranking assigned in descending order of the degree of constraint satisfaction represented by the constraint satisfaction score, in association with the countermeasure set.

[0157] Furthermore, by the calculation unit 20C and the selection unit 20D performing the processes of steps S106 to S116 for each of the multiple countermeasure sets generated in step S104, the countermeasure set that satisfies the resilience requirements obtained in step S100 is selected as the optimal resilience design information for the target system 40.

[0158] The output control unit 20E rearranges the countermeasure sets for ranking calculation stored in step S116 in ascending order of constraint satisfaction scores (step S118).

[0159] Then, the output control unit 20E outputs the set of measures rearranged in step S118 as optimal resilience design information for the target system 40 (step S120), and then ends this routine.

[0160] As described above, the information processing device 10 of this embodiment includes a first acquisition unit 20A, a calculation unit 20C, and a selection unit 20D. The first acquisition unit 20A acquires resilience requirements for the target system 40. The calculation unit 20C calculates a resilience index of the target system 40 to which the countermeasure set has been applied, for each of a plurality of countermeasure sets, each of which combines one or more mutually different countermeasures for resilience. The selection unit 20D selects, from the plurality of countermeasure sets, a countermeasure set that satisfies the resilience requirements as resilience design information, based on the resilience index calculated for each of the plurality of countermeasure sets.

[0161] In this way, the information processing device 10 of this embodiment selects, from among multiple countermeasure sets that combine one or more different countermeasures for resilience, a countermeasure set whose resilience index satisfies the resilience requirements, as the optimal resilience design information for the target system 40.

[0162] Therefore, by acquiring the resilience requirements required of the target system 40, the information processing device 10 can select optimal resilience design information that satisfies the resilience requirements.

[0163] Therefore, the information processing device 10 of this embodiment can provide optimal resilience design information suited to the target system 40.

[0164] Furthermore, the information processing device 10 of this embodiment can provide resilience design information that takes into account the constraints of the target system 40 and is suitable for the target system 40.

[0165] Furthermore, the information processing device 10 of this embodiment acquires resilience requirements required of the target system 40, and selects optimal resilience design information that satisfies the resilience requirements.

[0166] Therefore, by inputting the desired resilience requirements required for the target system 40, the user can be provided with optimal resilience design information that satisfies the resilience requirements. In other words, even a user who is unfamiliar with system design or who does not have specialized knowledge about resilience can input the desired resilience requirements and be provided with optimal resilience design information that satisfies the resilience requirements. Furthermore, the information processing device 10 of this embodiment can provide information that can facilitate the design of a resilient system to a designer who is unfamiliar with system design or who does not have specialized knowledge about resilience.

[0167] (Second embodiment) In this embodiment, a form will be described in which the nodes included in the target system 40 are classified into a plurality of groups, and resilience design information is selected for each group using the resilience index calculated for each classified group.

[0168] FIG. 10 is a schematic diagram of an example of an information processing device 10B according to this embodiment.

[0169] The information processing device 10B includes a UI unit 12, a storage unit 14, and a processing unit 21. The information processing device 10B is similar to the information processing device 10 of the above embodiment, except that it includes the processing unit 21 instead of the processing unit 20.

[0170] Processing unit 21 includes first acquisition unit 21A, second acquisition unit 21B, calculation unit 21C, selection unit 21D, output control unit 21E, third acquisition unit 21F, and classification unit 21G. Processing unit 21 includes first acquisition unit 21A, second acquisition unit 21B, calculation unit 20C, selection unit 20D, and output control unit 20E in processing unit 20, but instead includes first acquisition unit 21A, second acquisition unit 21B, calculation unit 21C, selection unit 21D, and output control unit 21E. Processing unit 21 also includes third acquisition unit 21F and classification unit 21G. Except for these points, processing unit 21 is similar to processing unit 20.

[0171] The third acquisition unit 21F acquires the system configuration information.

[0172] The system configuration information is information relating to the plurality of nodes included in the target system 40 and the flow of data between the plurality of nodes. For example, the system configuration information includes information representing the functional configuration of each of the plurality of nodes included in the target system 40, the number of included nodes, the flow of data between the nodes, etc.

[0173] The third acquisition unit 21F acquires system configuration information input by a user's operation instruction on the UI unit 12 from the UI unit 12. The third acquisition unit 21F may also acquire the system configuration information of the target system 40 from an external information processing device connected to the information processing device 10B via a network or the like. The third acquisition unit 21F may also acquire system configuration information by reading system configuration information stored in advance in the storage unit 14 from the storage unit 14.

[0174] Similar to the first acquisition unit 20A in the above embodiment, the first acquisition unit 21A acquires resilience requirements for the target system 40. However, the first acquisition unit 21A acquires resilience requirements for each of the nodes included in the target system 40.

[0175] Fig. 11 is an explanatory diagram of an example of resilience requirements for each node acquired by the first acquisition unit 21A. As in the above embodiment, Fig. 11 shows a form in which the resilience requirements are expressed by KPI relative values. Fig. 11 also shows a form in which the first acquisition unit 21A acquires a conditional expression for the KPI relative value for each node as the resilience requirement.

[0176] Returning to FIG. 10, the explanation will be continued.

[0177] The classification unit 21G classifies the multiple nodes included in the target system 40 into multiple groups with similar resilience requirements based on the resilience requirements for each of the multiple nodes included in the target system 40 acquired by the first acquisition unit 21A.

[0178] For example, the classification unit 21G groups nodes having similar KPI target values ​​expressed by the conditional expressions of the KPI relative values, which are the resilience requirements acquired by the first acquisition unit 21A. For example, assume that the resilience requirements shown in FIG. 11 are acquired by the first acquisition unit 21A. In this case, the KPI target values ​​of the combinations of node 1 and node 3, and node 2 and node 4 are similar. Therefore, the classification unit 21G classifies, for example, nodes 1 to 4 that make up the target system 40 into two groups: a group consisting of node 1 and node 3, and a group consisting of node 2 and node 4.

[0179] Furthermore, the classification unit 21G may classify the multiple nodes constituting the target system 40 into multiple groups in consideration of the data flow represented by the system configuration information so as to reduce data exchange between nodes belonging to the same group. Through this processing, the classification unit 21G can classify the multiple nodes included in the target system 40 into multiple groups in a way that minimizes the attack surface.

[0180] Returning to FIG. 10, the explanation will be continued.

[0181] Similar to the second acquisition unit 20B, the second acquisition unit 21B acquires system constraint information for the target system 40. However, the second acquisition unit 21B acquires system constraint information for each group classified by the classification unit 21G.

[0182] The second acquisition unit 21B acquires, for example, system constraint information for each of the groups of the target systems 40, which is input by a user through an operation instruction on the UI unit 12, from the UI unit 12. The second acquisition unit 21B may also acquire system constraint information for each of the groups of the target systems 40 from an external information processing device connected to the information processing device 10 via a network or the like. The second acquisition unit 21B may also acquire system constraint information by reading, from the storage unit 14, system constraint information for each of the groups of the target systems 40 that has been stored in advance in the storage unit 14.

[0183] FIG. 12 is a schematic diagram of an example of system constraint information acquired by the second acquisition unit 21B.

[0184] As shown in FIG. 12, the second acquisition unit 21B acquires, as system constraint information, information representing the constraint requirement level required for each constraint item for each group into which the multiple nodes included in the target system 40 are classified.

[0185] Returning to FIG. 10, the explanation will be continued.

[0186] The calculation unit 21C calculates, for each of the plurality of countermeasure sets, a resilience index of the target system 40 to which the countermeasure set has been applied, similar to the calculation unit 20C in the above embodiment. However, in this embodiment, the calculation unit 21C calculates a resilience index of each of the plurality of countermeasure sets for each of the plurality of groups classified by the classification unit 21G.

[0187] The calculation unit 21C calculates the resilience index in the same manner as the calculation unit 20C in the above embodiment, except that instead of calculating the resilience index for the entire target system 40, the calculation unit 21C calculates the resilience index for each group into which the multiple nodes constituting the target system 40 are classified.

[0188] Similar to the selection unit 20D in the above embodiment, the selection unit 21D selects, from among the multiple countermeasure sets, a countermeasure set that satisfies the resilience requirements acquired by the first acquisition unit 20A as resilience design information based on the resilience index (KPI relative value) calculated for each of the multiple countermeasure sets. However, the selection unit 21D selects, for each group of target systems 40, the resilience design information that is optimal for that group.

[0189] The selection unit 21D may select resilience design information in the same manner as the selection unit 20D in the above embodiment, except that, instead of selecting the entire target system 40, the selection unit 21D selects a set of measures that satisfy the resilience requirements selected for each group into which the multiple nodes constituting the target system 40 are classified as the optimal resilience selection information for the group. Note that the selection unit 21D may use the strictest resilience requirement (highest evaluation value) among the resilience requirements of the nodes included in the group to be processed as the resilience requirement used to determine whether or not the resilience requirement is satisfied. Alternatively, the selection unit 21D may make the determination using the resilience requirement with the lowest evaluation value among the resilience requirements of the nodes included in the group to be processed.

[0190] The output control unit 21E outputs the resilience information selected by the selection unit 21D, similar to the output control unit 20E. However, the output control unit 21E outputs the resilience information for each group of the target systems 40 selected by the selection unit 21D.

[0191] Similarly to the output control unit 20E, the output control unit 21E may output the resilience information selected by the selection unit 21D and at least one of the resilience requirements acquired by the first acquisition unit 21A and the system constraint conditions acquired by the second acquisition unit 21B. The output control unit 21E may further sort and output the resilience information selected by the selection unit 21D in descending order of the degree of constraint satisfaction represented by the constraint satisfaction score. The output control unit 21E may output the resilience design information selected by the selection unit 21D in association with the overall ranking assigned to the resilience setting information.

[0192] Next, an example of the flow of information processing executed by the information processing device 10B of this embodiment will be described.

[0193] FIG. 13 is a flowchart showing an example of the flow of information processing executed by the information processing device 10B of this embodiment.

[0194] The third acquisition unit 21F acquires the system configuration information (step S200). For example, the user inputs desired system configuration information by operating the UI unit 12. The third acquisition unit 21F acquires the system configuration information input by the user from the UI unit 12.

[0195] The first acquisition unit 21A acquires a resilience requirement for each node that configures the target system 40 (step S202). For example, the user inputs a desired resilience requirement by operating the UI unit 12. The first acquisition unit 21A acquires, from the UI unit 12, the resilience requirement for each node that has been input by the user.

[0196] The classification unit 21G classifies the plurality of nodes included in the target system 40 into a plurality of groups based on the resilience requirements for each of the plurality of nodes included in the target system 40 acquired in step S202 (step S204).

[0197] Then, second acquisition unit 21B acquires system constraint information for each group classified in step S204 (step S206). For example, the user inputs desired system constraint information for each group by operating UI unit 12. Second acquisition unit 21B acquires the system constraint information for each group input by the user from UI unit 12.

[0198] Then, the processing unit 21 executes steps S208 to S222 for each of the groups classified in step S204.

[0199] The calculation unit 21C generates, for the group to be processed, a plurality of countermeasure sets that differ in at least one of the number and type of included countermeasures, using a plurality of countermeasures registered in the cyber resilience catalog 14A (step S208).

[0200] Then, the calculation unit 21C and the selection unit 21D execute steps S210 to S222 for each of the multiple countermeasure sets generated in step S208.

[0201] In detail, the calculation unit 21C calculates resilience parameters that represent the degree of improvement of each resilience item when the measures constituting the countermeasure set to be processed are introduced into the target system 40 (step S210).

[0202] Then, the calculation unit 21C calculates a resilience index for the target measure set of the target group by using the resilience parameter values ​​of each resilience item calculated in step S210 (step S212). As described above, for example, the calculation unit 21C calculates the KPI relative value as the resilience index.

[0203] Next, the calculation unit 21C calculates a score representing the degree of fulfillment of the constraint requirements for each constraint item for the countermeasure set being processed, based on the impact parameters and the constraint requirement level for each constraint item represented by the system constraint information for the group being processed obtained in step S206 (step S214).

[0204] Then, the calculation unit 21C uses the score calculated for each constraint item in step S214 to calculate a constraint satisfaction score representing the degree of satisfaction of the constraints represented by the system constraint information for the countermeasure set to be processed (step S216).

[0205] Next, the selection unit 21D determines whether the resilience index calculated in step S212 satisfies the strictest requirement among the resilience requirements acquired in step S202 for each node belonging to the group being processed (step S218). If it is determined that the resilience requirement is not satisfied (step S218: No), the processing for the countermeasure set is terminated. If it is determined that the resilience requirement is satisfied (step S218: Yes), the processing proceeds to step S220.

[0206] In step S220, the selection unit 21D stores the countermeasure set to be processed, for which a positive determination was made in step S218, in the storage unit 14 as a countermeasure set for use in ranking calculation (step S220).

[0207] The processing unit 21 executes the processes of steps S210 to S220 for each of the multiple countermeasure sets generated in step S208, and thereby the countermeasure sets of the resilience index that satisfy the resilience requirements are stored as countermeasure sets for ranking calculation in the storage unit 14. At this time, the selection unit 21D may store in the storage unit 14 at least one of the resilience requirements, system constraint information, resilience index, constraint satisfaction score, and overall ranking assigned in descending order of the degree of constraint satisfaction represented by the constraint satisfaction score, in association with the countermeasure set.

[0208] Furthermore, by the processing unit 21 performing the processes of steps S210 to S220 for each of the multiple countermeasure sets generated in step S208, the countermeasure set that satisfies the resilience requirements obtained in step S202 is selected as the optimal resilience design information for the target system 40.

[0209] The output control unit 21E rearranges the countermeasure sets for ranking calculation stored in step S220 in ascending order of constraint satisfaction scores (step S222).

[0210] The processing unit 21 executes the processes of steps S208 to S222 for each group classified in step S204, so that for each group into which the multiple nodes constituting the target system 40 are classified, a set of countermeasures that meets the resilience requirements of each group is selected as the optimal resilience design information for that group.

[0211] Then, the output control unit 21E outputs the countermeasure sets sorted by group in step S222 to the target system 40 as optimal resilience design information for each group into which the nodes are classified (step S224). Then, this routine ends.

[0212] As described above, the third acquisition unit 21F of the information processing device 10B of this embodiment acquires system configuration information related to multiple nodes included in the target system 40 and the flow of data between the multiple nodes. The classification unit 21G classifies the multiple nodes included in the target system 40 into multiple groups with similar resilience requirements, based on the resilience requirements for each of the multiple nodes included in the target system 40 acquired by the first acquisition unit 21A. The calculation unit 21C calculates a resilience index for each of the multiple countermeasure sets for each of the multiple groups. The selection unit 21D selects, for each of the multiple groups, a countermeasure set from the multiple countermeasure sets that satisfies the resilience requirements, as resilience design information for each of the multiple groups, based on the resilience index calculated for each of the multiple countermeasure sets.

[0213] Therefore, the information processing device 10B of the present embodiment can appropriately classify the target system 40 having a mixture of resilience requirements into a plurality of groups and provide resilience design information for each group.

[0214] Therefore, in addition to the effects of the above embodiments, the information processing device 10B of this embodiment can provide optimal resilience design information for each group into which the multiple nodes constituting the target system 40 are classified.

[0215] (Third embodiment) In this embodiment, a form will be described in which code used for implementing resilience design information in the target system 40 is generated and provided.

[0216] FIG. 14 is a schematic diagram of an example of an information processing device 10C according to this embodiment.

[0217] The information processing device 10C includes a UI unit 12, a storage unit 15, and a processing unit 23. The information processing device 10C is similar to the information processing device 10 of the above embodiment except that it includes the storage unit 15 and the processing unit 23 instead of the storage unit 14 and the processing unit 20.

[0218] The storage unit 15 stores a cyber resilience catalog 14A, a score conversion table 14B, and a software component group 14C. The storage unit 15 is similar to the storage unit 14 of the above embodiment, except that the storage unit 15 further stores the software component group 14C.

[0219] The software component group 14C is a group of software components used when implementing the countermeasures in the target system 40. In the software component group 14C, a group of software components used when implementing each of the multiple countermeasures registered in the cyber resilience catalog 14A in the target system 40 is registered in advance.

[0220] The processing unit 23 includes a first acquisition unit 20A, a second acquisition unit 20B, a calculation unit 20C, a selection unit 20D, an output control unit 20E, and a code generation unit 23H. The processing unit 23 is similar to the processing unit 20 of the above embodiment, except that it further includes the code generation unit 23H.

[0221] The code generation unit 23H generates code used to implement the resilience design information in the target system 40, based on the resilience design information selected by the selection unit 20D.

[0222] The code is code used in software, and may be code used to implement the resilience design information in the target system 40. The code may be, for example, IaC (Infrastructure as Code), a manifest, or source code.

[0223] The code generation unit 23H selects, from the software component group 14C, software components corresponding to the measures that constitute the measure set represented by the resilience design information selected by the selection unit 20D. Then, the code generation unit 23H generates, as code, IaC that automates the incorporation of the selected software components into the target system 40. The code generation unit 23H generates IaC for each measure set selected by the selection unit 20D.

[0224] The output control unit 23E outputs the resilience information selected by the selection unit 20D, similar to the output control unit 20E of the above embodiment. The output control unit 23E may output the resilience information selected by the selection unit 20D and at least one of the resilience requirements acquired by the first acquisition unit 20A and the system constraint conditions acquired by the second acquisition unit 20B. The output control unit 23E may further sort the resilience information selected by the selection unit 20D in descending order of the degree of constraint satisfaction represented by the constraint satisfaction score, and output the resilience information. The output control unit 23E may output the resilience design information selected by the selection unit 20D in association with the overall ranking assigned to the resilience setting information.

[0225] The output control unit 23E further outputs the IaC generated by the code generation unit 23H for each countermeasure set represented by the resilience design information selected by the selection unit 20D.

[0226] Next, an example of the flow of information processing executed by the information processing device 10C of this embodiment will be described.

[0227] FIG. 15 is a flowchart showing an example of the flow of information processing executed by the information processing device 10C of this embodiment.

[0228] The processing unit 23 of the information processing device 10C executes the processes of steps S300 to S318 in the same manner as the processing unit 20 of the above embodiment. Steps S300 to S318 correspond to steps S100 to S118 in FIG.

[0229] Then, the code generation unit 23H of the information processing device 10C generates code to be used for implementing the resilience design information in the target system 40, based on the resilience design information stored as the countermeasure set for ranking calculation in step S316 (step S320). For example, the code generation unit 23H generates IaC for each countermeasure set represented by the resilience design information, thereby generating code to be used for implementing the resilience design information in the target system 40.

[0230] The output control unit 23E outputs the set of measures rearranged in step S318 as optimal resilience design information according to the target system 40, and also outputs the IaC generated in step S320 (step S322). Then, this routine ends.

[0231] As described above, in the information processing device 10C of this embodiment, the code generation unit 23H generates code to be used for implementing the resilience design information in the target system 40, based on the resilience design information.

[0232] Therefore, in addition to the effects of the above-described embodiments, the information processing device 10C of this embodiment can facilitate the implementation of optimal resilience design information for the target system 40 in the target system 40.

[0233] Next, an example of the hardware configuration of the information processing device 10, the information processing device 10B, and the information processing device 10C of the above embodiment will be described.

[0234] FIG. 16 is a diagram illustrating an example of the hardware configuration of the information processing device 10, the information processing device 10B, and the information processing device 10C according to the above embodiment.

[0235] The information processing device 10, information processing device 10B, and information processing device 10C of the above embodiments are equipped with a control device such as a CPU (Central Processing Unit) 90B, a storage device such as a ROM (Read Only Memory) 90C, a RAM (Random Access Memory) 90D, and an HDD (Hard Disk Drive) 90E, an I / F unit 90A that interfaces with various devices, and a bus 90F that connects each unit, and have a hardware configuration that uses a normal computer.

[0236] In the information processing device 10, the information processing device 10B, and the information processing device 10C of the above-described embodiments, the CPU 90B reads a program from the ROM 90C onto the RAM 90D and executes it, thereby realizing each of the above-described units on the computer.

[0237] The programs for executing the above processes executed by the information processing device 10, the information processing device 10B, and the information processing device 10C of the above embodiments may be stored in the HDD 90E. Also, the programs for executing the above processes executed by the information processing device 10, the information processing device 10B, and the information processing device 10C of the above embodiments may be provided by being pre-installed in the ROM 90C.

[0238] The programs for executing the above processes executed by the information processing device 10, information processing device 10B, and information processing device 10C of the above embodiments may be stored in an installable or executable file format on a computer-readable storage medium such as a CD-ROM, CD-R, memory card, DVD (Digital Versatile Disc), or flexible disk (FD) and provided as a computer program product. The programs for executing the above processes executed by the information processing device 10, information processing device 10B, and information processing device 10C of the above embodiments may be stored on a computer connected to a network such as the Internet and provided by downloading via the network. The programs for executing the above processes executed by the information processing device 10, information processing device 10B, and information processing device 10C of the above embodiments may be provided or distributed via a network such as the Internet.

[0239] Although the embodiments of the present invention have been described above, the above embodiments are presented as examples and are not intended to limit the scope of the invention. This novel embodiment can be embodied in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. This embodiment and its modifications are included within the scope and spirit of the invention, and are also included in the invention and its equivalents as defined in the claims. [Explanation of symbols]

[0240] 10, 10B, 10C Information processing device 20A, 21A 1st acquisition part 20B, 21B 2nd acquisition part 20C, 21C calculation section 20D, 21D selection department 20E, 21E, 23E Output control section 21F 3rd Acquisition Department 21G classification section 23H Code Generator

Claims

1. a first acquisition unit that acquires resilience requirements for a target system; a calculation unit that calculates a resilience index of the target system to which a countermeasure set is applied, for each of a plurality of countermeasure sets, each of which combines one or a plurality of mutually different countermeasures for resilience; a selection unit that selects, from the plurality of countermeasure sets, the countermeasure set that satisfies the resilience requirements as resilience design information based on the resilience index calculated for each of the plurality of countermeasure sets; Equipped with The calculation unit calculating the resilience index for each of the countermeasure sets based on resilience parameters that indicate the degree of improvement of each of a plurality of resilience items when the countermeasures represented by the countermeasure sets are introduced into the target system; Information processing device.

2. The resilience items are: At least one item of the following items is included: an item regarding the success rate of an attack on the target system; an item regarding the operational function of the target system; and an item regarding the downtime period of the target system. The information processing device according to claim 1 .

3. The resilience items are: The improvement rate of the function availability rate, which is an item related to the operational function, the improvement rate of the recovery time, which is an item related to the outage period, and the improvement rate of the attack success rate, which is an item related to the attack success rate, The calculation unit The resilience index is calculated by integrating the outage rate calculated from the function availability rate over the recovery time and by using the attack success rate. The information processing device according to claim 2 .

4. a second acquisition unit that acquires system constraint information indicating a constraint requirement level required for each constraint item of the target system; The calculation unit For each of the countermeasure sets, calculate a score representing the degree of fulfillment of the constraint requirements for each of the constraint items according to an impact parameter representing the degree of impact other than resilience that occurs on the target system when the countermeasures are introduced into the target system and the constraint requirement level for each of the acquired constraint items; calculating a constraint satisfaction score representing the degree of satisfaction of the constraints represented by the system constraint information for each of the countermeasure sets using the scores; The selection unit selecting the countermeasure set, in which the resilience index satisfies the resilience requirement and the constraint satisfaction score satisfies a predetermined condition, as the resilience design information; The information processing device according to claim 1 .

5. An output control unit that outputs the resilience design information, The information processing device according to claim 1 .

6. a third acquisition unit that acquires system configuration information relating to a plurality of nodes included in the target system and a data flow between the plurality of nodes; a classification unit that classifies the plurality of nodes included in the target system into a plurality of groups having similar resilience requirements based on the resilience requirements for each of the plurality of nodes included in the target system acquired by the first acquisition unit; Equipped with The calculation unit calculating the resilience index for each of the plurality of countermeasure sets for each of the plurality of groups; The selection unit selecting, for each of the plurality of groups, a measure set that satisfies the resilience requirement from among the plurality of measure sets based on the resilience index calculated for each of the plurality of measure sets, as the resilience design information for each of the plurality of groups; The information processing device according to claim 1 .

7. The classification unit classifying the plurality of nodes included in the target system into a plurality of groups based on the system configuration information so as to minimize an attack surface; The information processing device according to claim 6 .

8. a code generation unit that generates code to be used for implementing the resilience design information in the target system based on the resilience design information; The information processing device according to claim 1 .

9. An information processing method executed by an information processing device, comprising: obtaining resilience requirements for a target system; a calculation step of calculating a resilience index of the target system to which a countermeasure set is applied for each of a plurality of countermeasure sets, each of which combines one or a plurality of mutually different countermeasures for resilience; a selection step of selecting, from the plurality of countermeasure sets, the countermeasure set that satisfies the resilience requirements as resilience design information based on the resilience index calculated for each of the plurality of countermeasure sets; Including, The calculation step calculating the resilience index for each of the countermeasure sets based on resilience parameters that indicate the degree of improvement of each of a plurality of resilience items when the countermeasures represented by the countermeasure sets are introduced into the target system; Information processing methods.

10. An information processing program to be executed by a computer, an acquisition step of acquiring resilience requirements for the target system; a calculation step of calculating a resilience index of the target system to which a countermeasure set is applied for each of a plurality of countermeasure sets, each of which combines one or a plurality of mutually different countermeasures for resilience; a selection step of selecting, from the plurality of countermeasure sets, the countermeasure set that satisfies the resilience requirements as resilience design information based on the resilience index calculated for each of the plurality of countermeasure sets; Including, The calculation step calculating the resilience index for each of the countermeasure sets based on resilience parameters that indicate the degree of improvement of each of a plurality of resilience items when the countermeasures represented by the countermeasure sets are introduced into the target system; Information processing program.

Images